High severity · published Dec 5, 2019
CVE-2019-18180
Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g
7.5
CVSS
2.6%
EPSS
No
On KEV
Description
Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: ((OTRS)) Community Edition 5.0.x version 5.0.38 and prior versions; 6.0.x version 6.0.23 and prior versions. OTRS AG: OTRS 7.0.x version 7.0.12 and prior versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OT
Otrs · Otrs
5.0.0 before 5.0.39; 6.0.0 before 6.0.24; 7.0.0 before 7.0.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18180
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18180
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
Patch
https://community.otrs.com/security-advisory-2019-15-security-update-for-otrs-framework/
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
More from Otrs
9.8
CVE-2024-23790
Missing file type check in avatar picture upload
9.8
CVE-2022-4427
Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1…
9.1
CVE-2026-48188
SQL Injection via MySQL Quote Method
9.1
CVE-2023-5422
SSL Certificates are not checked for E-Mail Handling
8.8
CVE-2023-38060
Host header injection by attachments in web service